Who decides…
Who decides whether to pay a ransom?
Add to board memoOpen the memo
The short answer
- Recommendation
- Only the board or its equivalent decides whether to pay a ransom, and only once legal advice including a sanctions check, the insurer's view and a report to law enforcement are in place. Plan recovery as if nothing will be paid.
- Reasoning
- Paying has legal, ethical and insurance consequences, so the decision sits with the top body, never with one manager, even in a small organisation. Who that is depends on how you are governed: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. The pack's plan assumes the organisation does not pay, so containment and recovery go ahead regardless of the demand.
- Considerations
- Nobody replies to the attacker or contacts them except through a channel the board has decided on, for example a specialist appointed through the insurer and Legal.
- Sanctions, insurance terms and reporting to the police depend on your jurisdiction and your policy. Take legal advice; this answer does not advise whether to pay.
- Whatever is decided, never say in public whether a ransom has been or will be paid.
The decision, step by step
Select any step for the reasoning behind it and where the pack covers it.
- Start
- Step
- Decision
- Outcome
- Loop back
Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.
Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.
Read as text
The same flow written out: each step, its reasoning and where the pack covers it. 10 steps.
Start
A ransom or extortion demand has arrived
A demand may come as a ransom note on screen, or as an email, call or post claiming your data has been stolen and will be published unless you pay, with or without encryption. Either way it is the same decision, and the same rule decides who takes it.
In the pack
- P09-A06 Ransomware Response PlaybookTriggers
- P09-A06 Ransomware Response PlaybookDecision tree
Step
Do not reply; keep the demand as evidence
Nobody replies to the attacker or follows any link or contact in the note. Photograph the note with the time visible, and keep every message, contact address and deadline. The insurer, law enforcement and any authority will ask for them.
In the pack
- P09-A06 Ransomware Response PlaybookDecision tree
- P09-A06 Ransomware Response PlaybookEvidence preservation
Step
Plan recovery as if nothing will be paid
The pack's plan assumes the organisation does not pay, so containment, the backup checks and the restore order go ahead regardless of the demand. In the pack's worked example the site was cut off, the backups were intact and the PCs were rebuilt, so recovery never depended on the attacker.
In the pack
- P09-A03 Incident Response PlanDecision rights
- P09-A06 Ransomware Response PlaybookDecision tree (rule D5)
- P09-A06 Ransomware Response PlaybookReports and notices made
Step
Name the body that decides: the board or its equivalent
The top body depends on how you are governed: the board, or a board risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board. Even in a small organisation the incident manager and the executive incident lead are two different people, and the pack's note says the decision on any ransom belongs to the board or the owners, never to one manager.
In the pack
- P09-A02 Security Incident Management PolicyRoles and responsibilities (rule IM-08)
- P09-A06 Ransomware Response PlaybookTailoring notes
Step
The executive incident lead takes it to that body
The executive incident lead leads the crisis team and takes the ransom question to the board or its equivalent. For a Severity 1 incident, the pack's default is that the board chair, or equivalent, is told within 4 hours of declaration. Legal advises that body before any decision on a demand.
In the pack
- P09-A06 Ransomware Response PlaybookRole actions by phase
- P09-A03 Incident Response PlanSeverity at a glance
- P09-A02 Security Incident Management PolicyRoles and responsibilities
Decision
Has the board decided a channel for any contact?
In the pack, nobody contacts the attacker except through a channel the board has decided on, for example a specialist appointed through the insurer and Legal. Legal agrees with the insurer how any contact will be handled. If no channel has been decided, or you are not sure, there is no contact.
- No, or not known: No contact until the board names a channel
- Yes: Are legal advice, sanctions, insurer and police all covered?
In the pack
- P09-A06 Ransomware Response PlaybookDecision tree
- P09-A06 Ransomware Response PlaybookContain (rule K8)
Step
No contact until the board names a channel
Keep recovering while the board decides. Further demands can arrive later, sometimes by email to managers or customers: brief the communications lead and the service desk to pass any such contact straight to the incident manager.
In the pack
- P09-A06 Ransomware Response PlaybookDecision tree
- P09-A06 Ransomware Response PlaybookMessages
Decision
Are legal advice, sanctions, insurer and police all covered?
The pack's rule: never before legal advice, including sanctions checks, the insurer's view and a report to law enforcement. Legal starts the sanctions check when a demand is made. The insurer is told as the policy requires and the crime is reported; neither waits for the investigation to finish. If any of the four is missing or unclear, the answer is no.
- No, or not known: Complete the missing inputs first
- Yes: The board or its equivalent decides, and it is minuted
In the pack
- P09-A03 Incident Response PlanDecision rights
- P09-A06 Ransomware Response PlaybookDecision tree (rules D5, D6)
Step
Complete the missing inputs first
Legal gives its advice and completes the sanctions check. The executive incident lead makes sure the insurer has been told and has given its view; Legal makes the crime report. Record each with its time and reference in the case log.
- Then: Are legal advice, sanctions, insurer and police all covered? (back to an earlier step)
In the pack
- P09-A06 Ransomware Response PlaybookDecision tree (rule D6)
- P09-A06 Ransomware Response PlaybookRole actions by phase
Outcome
The board or its equivalent decides, and it is minuted
Only that body decides, and its minutes are the evidence of the decision. The decision, who took it, when and why go in the decision log whether or not it turns out to be right. Whatever is decided, never say in public whether a ransom has been or will be paid.
In the pack
- P09-A02 Security Incident Management PolicyResponse and evidence (rule IM-08)
- P09-A03 Incident Response PlanDecision rights
- P09-A06 Ransomware Response PlaybookMessages
Practical checklist
- Do not reply; photograph the note with the time visible and keep every message, contact address and deadline.
- Continue containment and recovery as if nothing will be paid.
- Name the deciding body, and a deputy for it, in your incident plan.
- Have the executive incident lead take the question to that body; for Severity 1, the board chair or equivalent is told within 4 hours.
- Have Legal start the sanctions check and give its advice.
- Tell the insurer as the policy requires, and have Legal report the crime.
- Let that body decide only once all four inputs are in place, and minute the decision.
Evidence to have ready
- The demand with its contact details and any deadline, kept as evidence.
- The legal advice and sanctions check, the insurer notification and the crime report, each with its time and reference.
- The minutes of the decision, and the decision log entry with who decided, when and why.
Practitioner pulse
What other practitioners do
One question about your practice. Answer it to see how others answered. We don't ask who you are or where you work.
How this works
Answers are counted, not attributed: your answer adds one to the count for the option you chose, and we keep no account, IP address or organisation with it. A Cloudflare check confirms the answer comes from a person.
We discourage repeat answers from the same browser, but cannot prevent them, so treat the results as indicative. To do that, this browser remembers for 30 days that it answered this question, but not which option.
The results are the readers who chose to answer, not a survey of the profession, and the pack default is a starting point, not a norm. Results show once a question has 100 answers.
Assumptions
- Your incident plan names the body that decides and a deputy for it. The pack leaves it as a placeholder: the board chair, or the equivalent where there is no board.
- This flow says who decides and what must be in place first. It does not advise whether to pay. Sanctions, insurance terms and reporting to the police depend on your jurisdiction and your policy; take legal advice.
Not covered here
- Whether to restore or rebuild after ransomware. That is “If ransomware has encrypted production, do we restore or rebuild?”.
- Who may take a system offline during the response. That is “Who has the authority to take a production system offline?”.
- When the board is told of an incident. That is “When do we tell the board during an incident?”.
- Which authorities must be notified, and by when. That is “When do we have to notify a regulator, and under which regime?”.